Signalis
sign in--:--:--UTC
CVEs

CVE-2026-65400

exploited in the wild☆ pin
CVSS
9.8
Reports
11
First seen
Aug 7, 2026
Last seen
Sep 15, 2026
Affected product

macOS Screen Sharing

Associated actors

TeamPCP ×2Lazarus ×2Chinese-nexus APT (vCenter exploitation) ×1Chinese-speaking threat actor (IKE exploitation) ×1ExfilSquad ×1Fire Ant ×1Jewelbug ×1Kimsuky ×1Lazarus Group ×1LightSpy operator (China-linked) ×1Mabna Institute ×1Matryoshka ×1Operation Dream Job ×1PhantomEnigma ×1QTFY ×1Sandworm ×1ShinyHunters ×1Storm-1516 ×1Storm-2755 ×1Suspected China-nexus APT ×1

Recent reports

High

GovCERT.HK High Threat Alert: Multiple Apple Product Vulnerabilities

GovCERT.HKHigh

CERT-EU Cyber Brief August 2026: Espionage, Ransomware, and Supply-Chain Compromises

CERT-EU Threat IntelCritical

Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation

The Hacker NewsHigh

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA AdvisoriesHigh

Apple Security Advisory AV26-823: macOS Vulnerabilities Including Active CVE-2026-65400 Exploitation

Canadian Centre AlertsHigh

Threat Intelligence Report – 17 August 2026

Check Point ResearchCritical

Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More

The Hacker NewsCritical

Apple macOS Screen Sharing Flaw Exploited to Deploy Monero Miner

The Hacker NewsHigh

Hackers exploit macOS Screen Sharing flaw to deploy Monero miner

Bleeping ComputerCritical

Screen Sharing Pre-Authentication RCE on macOS: CVE-2026-43760 and CVE-2026-65400

Huntress BlogHigh

Vulnerability in Apple macOS – Security Restriction Bypass (CVE-2026-65400)

GovCERT.HK

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign upSee plans